Terms of service

These Terms of Service ("Terms") apply to all offers, agreements and services of Haakje B.V., registered with the Dutch Chamber of Commerce under number 42160038, VAT identification number NL869977817B01, established in Haarlem, trading under the name Aqlemy ("Aqlemy", "we", "us").

Who our counterparty is.

The agreement is concluded with an organisation: a foundation, association, school, educational institution, mosque, educational centre or umbrella organisation. The person who registers on behalf of that organisation declares that they are authorised to do so and binds the organisation. Members, students, parents and teachers use the Platform through their organisation and are not a party to this agreement; their relationship with the organisation is governed by that organisation's own rules.

Business use only.

Registration with the Chamber of Commerce or a foreign equivalent is mandatory. This is therefore not a consumer contract. Consumer law provisions — including the statutory right of withdrawal under article 6:230o of the Dutch Civil Code, the consumer ombudsman and the European ODR platform — do not apply to this agreement.

Which documents make up the agreement.

The agreement consists of: (a) the order or registration stating the chosen Package, (b) these Terms, (c) the Data Processing Agreement, and (d) the Privacy Policy and Cookie Policy insofar as they contain information about our own processing activities. In the event of conflict this order of precedence applies, with one exception: for everything concerning the processing of personal data on behalf of your organisation, the Data Processing Agreement prevails over these Terms. That exception is deliberate — a data processing agreement that can be set aside by general terms does not satisfy article 28 GDPR.

Your own purchasing terms.

The applicability of purchasing or other terms of your organisation is expressly rejected, unless we have accepted them in writing. If you wish to deviate from these Terms, we record those deviations in writing; only then do they apply, and only for the agreement for which they were agreed.

Version and provision of the text.

These Terms carry a version number and an effective date, shown at the top of this page. On each acceptance we record which version you accepted, at what moment, by which route, and a cryptographic checksum (sha256) of precisely this text. This establishes afterwards not only which version applied, but which characters it contained. That is what article 6:234 of the Dutch Civil Code requires of terms made available electronically: the text can be stored and reproduced, and remains available at aqlemy.com/en/terms-of-service.

Languages.

These Terms are available in Dutch, Turkish, English and Arabic. In the event of a difference in interpretation between the language versions, the Dutch text prevails. We are not liable for imperfections in a translation, except in the case of intent or wilful recklessness.

In these Terms, the following terms have the following meaning, in the singular and the plural:

Aqlemy / we / us: Haakje B.V., Chamber of Commerce number 42160038, VAT number NL869977817B01, Haarlem, trading under the name Aqlemy.

Organisation / you / your: the legal entity or organisation that enters into the agreement with us and under whose account the Platform is used.

Platform: the management platform operated by Aqlemy, consisting of the administration portal, the programming interfaces, the public organisation pages, the information screens and the mobile applications.

Services: everything we deliver under the agreement: making the Platform available, hosting, storage, maintenance, support and the associated documentation.

Package: the combination of functionality you have chosen — Membership System, Education Light, Education Complete or Membership+Education Complete — which determines which parts of the Platform are available to your organisation.

End User: a natural person who uses the Platform under the Organisation's account: an administrator, teacher, parent, student or member.

Administrator: an End User to whom the Organisation has granted administrative rights.

Customer Data: all data that the Organisation or its End Users enter, upload or cause to exist on the Platform, including personal data, files, messages and financial records. Customer Data is and remains the Organisation's.

Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach: the terms as defined in article 4 GDPR.

Data Processing Agreement / DPA: the agreement referred to in article 28(3) GDPR, published at aqlemy.com/en/processing-agreement, which forms an integral part of the agreement.

Sub-processor: a third party that processes Personal Data on our instructions. The current register is at aqlemy.com/en/subprocessors.

Trial Period: the period of 30 days after registration during which the chosen Package may be used free of charge.

Subscription: the continuing agreement against periodic payment, after the end of the Trial Period.

Outage: the Platform being unavailable or not fully available, other than through Scheduled Maintenance or through a cause attributable to the Organisation or to its own facilities.

Scheduled Maintenance: maintenance we announce in advance, as described in article 10.

Business Day: Monday through Friday, excluding public holidays generally recognised in the Netherlands.

In writing: on paper or by electronic means, including email and a notice in the administration portal, provided the content can be stored and reproduced.

Umbrella Organisation: an Organisation of the umbrella type, to which other Organisations may be linked as child organisations.

Advertiser: a business that purchases advertising space from an Organisation via the Platform, as governed by article 6.

How the agreement is formed.

The agreement is formed at the moment you register, accept these Terms and the Data Processing Agreement, and we confirm your registration. If you register through our website, acceptance takes place via the payment screen of our payment service provider, which separately records your agreement to these Terms. Your acceptance is thereby registered in two administrations.

If your organisation registers by another route — for example because the agreement was concluded outside the portal, or because your organisation falls under an Umbrella Organisation — the agreement is formed by our written confirmation, and you accept these Terms upon first sign-in to the administration portal.

Authority.

The person registering on behalf of the Organisation declares and warrants that they are authorised to bind the Organisation. If that authority proves to be absent, that person is personally bound by the agreement, without prejudice to our right to rescind it.

Trial Period.

• - New organisations receive a 30-day trial period on the chosen Package.
• - Nothing is charged at sign-up. You only provide a SEPA direct debit mandate, which is not used until after the trial period ends.
• - During the trial period you have access to all functions of the chosen Package.
• - You may cancel free of charge at any time during the trial period. Cancellation takes effect immediately, nothing is ever collected, and access ends at the end of the trial period.
• - If you do not cancel, the Subscription commences automatically at the end of the trial period.
• - We may grant a longer trial period. Such an extension applies only to the registration for which it was granted and creates no right to repetition.

Term and renewal.

The Subscription is entered into for an indefinite period and renews tacitly each month, unless a different term has been agreed in writing. Cancellation is governed by article 15.

One organisation, one account.

The Platform may only be used for the Organisation's own organisation. It is not permitted to allow third parties to use the Services, other than the End Users of the own organisation and — in the case of an Umbrella Organisation — the organisations linked to it, within the functionality provided for that purpose.

What the Platform does.

Aqlemy is a management platform for membership-driven organisations. Depending on the chosen Package it includes, among other things:

• - Membership management: member records, membership types, contributions and registration forms.
• - Education management: student files, classes, homework, attendance, progress, exams and certificates.
• - Communication: announcements, events, newsletters, chat, notifications and email.
• - Finance: payment requests, subscriptions and direct debits for your own members, cash book, invoices, expense claims, subsidies and public-benefit accountability.
• - Publication: a public organisation page, embeds, information screens (narrowcasting) and — for the Education Complete and Membership+Education Complete packages — publication on your own domain name.
• - Mobile applications for members, parents, students and teachers.

The exact composition per Package is stated on our website and in the administration portal. Components not included in your Package are not available.

What we do not provide.

We do not provide legal, tax, educational or accounting advice. Reports, cash book overviews, public-benefit exports and tax aids are tools; the accuracy of the underlying data and the accountability for it remain your responsibility.

Development and change of the Services.

The Platform is under continuous development. We may add, change or remove functions. We do not warrant that any specific function or characteristic will be maintained unchanged.

Where a change materially reduces the usefulness of the Platform for your organisation — for example the removal of a function your organisation demonstrably uses — we announce it at least 30 days in advance and you may terminate the agreement as of the date the change takes effect. That right does not apply where the change results from amended legislation, from an instruction of a competent authority, or from a necessary security measure.

Making available.

The Services commence as soon as we make the access credentials to the administration portal available to you. You provide the necessary equipment, internet connection and an up-to-date browser or app version yourself.

Configuration and migration.

Unless otherwise agreed, you configure the Platform yourself: settings, classes, member records, payment connections and branding. We provide input tools (including import from Excel) and documentation. For guidance beyond standard support we may charge a fee, after prior notification.

Third-party connections.

The Platform offers optional connections with third-party services, including payment service providers, email services, email marketing, social media and calendar services. You enable those connections yourself. The terms of those third parties apply to their use; we are not responsible for their availability, accuracy or continued existence. If we discontinue a connection because the third party discontinues it or changes its terms, we notify you as soon as we know.

Prices.

Current prices are stated on our website and in the administration portal. Prices are in euros and, unless expressly stated otherwise, exclusive of 21% VAT and other government levies.

Trial period.

Nothing is collected during the trial period. A refund is therefore not applicable, because nothing was paid.

Automatic renewal and direct debit.

• - After the trial period ends, the Subscription commences automatically and is collected monthly in advance.
• - Payment is made by SEPA direct debit on the basis of the mandate you provided at registration. You thereby authorise Haakje B.V. to debit the agreed amount periodically.
• - The amount and the moment of collection follow from your Subscription and are visible in the administration portal at all times. You receive an invoice or payment confirmation from our payment service provider by email. The parties agree that the pre-notification period for the direct debit is shortened to at least one calendar day before the collection date, as the SEPA rulebook permits.
• - A SEPA direct debit is additionally subject to the refund right applied by your bank.

Price changes.

We may adjust prices. We announce an increase at least 30 days before the effective date. If you do not agree, you may terminate the agreement as of the date the new price takes effect; if you do not, the new price applies. A price change never applies to a running trial period. Where only the VAT rate or another government levy changes, we may pass that change on immediately.

Change of Package.

You may switch to another Package in the administration portal. An upgrade takes effect from the next billing period, without settlement over the current period. A downgrade is deferred until the end of the current period and takes effect thereafter. Periods already paid are not refunded pro rata.

Failed direct debit.

• - If a collection is reversed or refused, you are notified and we make another attempt.
• - If payment remains outstanding, a grace period of seven days from the last successful payment applies, during which the Platform remains fully usable, with a warning in the administration portal.
• - If payment has still not been received after those seven days, access to the Platform is suspended. Your data remains unchanged; suspension is not deletion.
• - We never delete your data automatically for non-payment. Deletion only takes place after termination of the agreement and in accordance with article 16.
• - If the outstanding payment is subsequently made, access is restored.

Default and collection costs.

If payment fails to arrive, you are in default without further notice. We are then entitled to charge statutory commercial interest (article 6:119a of the Dutch Civil Code), as well as the reasonable costs of obtaining payment out of court, in accordance with the Dutch Act on the standardisation of extrajudicial collection costs.

Goodwill arrangement for the first paid month.

Because the agreement is a business agreement, no statutory right of withdrawal applies. On our own initiative we offer the following: if you cancel within 14 days of the first paid month, we refund that month. Refunds are made within 14 business days to the bank account from which the collection was made. The arrangement applies once, per organisation, and not to subsequent months already elapsed.

Advertising intermediation fee.

If your organisation sells advertising space via the Platform, the fee arrangement in article 6 applies.

Money from your own members.

Contributions, parental contributions, donations, event tickets and payment requests that your organisation collects via the Platform run through your own organisation's bank account with its own payment service provider. That money never passes through us. We are not a payment service provider, we do not hold any of your organisation's funds, and we are not a party to the payment relationship between your organisation and its members.

An Organisation may offer advertising space to business advertisers via the Platform. The following division of roles applies.

Aqlemy's role: Aqlemy provides only the technical platform and acts as intermediary. Aqlemy is not a party to the agreement between the Organisation and the advertiser, is not the publisher of the advertisement, and does not assess its content.

The Organisation's role: The Organisation is the contracting party and the publisher. It decides which advertisements it accepts or refuses, sets its own rates, invoices the advertiser and is responsible for the content appearing on its channels — including compliance with the Dutch Advertising Code and other applicable legislation.

Intermediation fee: Aqlemy charges the Organisation an intermediation fee: a percentage of the net (excluding VAT) advertising amount. That amount is not withheld from the advertiser's payment — the advertiser pays the full amount directly to the Organisation. The fee is invoiced monthly in arrears, over the advertisements paid for in that month. If the Organisation has a subscription with Aqlemy, the fee appears as a separate line on the next subscription invoice; if it does not, it receives a separate invoice with its own payment link. The fee is itself subject to VAT: 21% VAT is added to the stated percentage. The applicable percentage is visible in the administration portal; a change applies only to advertisements paid for thereafter.

Business only: The advertiser portal is open only to businesses and organisations; a Chamber of Commerce registration number or a foreign equivalent is required. There is therefore no consumer agreement and no statutory right of withdrawal.

Order of review and payment: An advertisement is first reviewed by the Organisation and only paid for after approval. A rejection costs the advertiser nothing.

Multiple placements in one order: An advertiser may book several advertising placements at once and pay for them in a single transaction. Each placement is reviewed separately: the Organisation may approve one and refuse another. The payment covers only the approved placements; nothing is owed for a refused placement.

Availability of a placement: The Organisation determines how many advertisers fit simultaneously in the same placement, within an upper limit per format set by Aqlemy. If it sells a placement to more than one advertiser, impressions are divided among them. If a placement is full for the chosen period, it cannot be booked.

No personalised advertising: Advertisements are shown to all users of the relevant Organisation. No profiling takes place, no third-party advertising SDK is used and no personal data is provided to advertisers.

Recognisability: Every advertisement visibly carries the label "Advertisement", the name of the advertiser and an explanation of why it is shown. This follows from article 26 of the Digital Services Act and from the recognisability requirement of the Dutch Advertising Code, and cannot be switched off.

Tax: Advertising income may constitute a commercial activity for a foundation or association and is in principle subject to VAT. The Organisation is itself responsible for the tax treatment; Aqlemy does not provide tax advice.

Accuracy of data.

You are responsible for the accuracy, completeness and currency of the Customer Data. We do not review that content and are not obliged to do so.

Legal basis and duty to inform.

You are the controller for the personal data you process via the Platform. You ensure a valid legal basis (article 6 GDPR, and where applicable article 9), inform your members, students, parents and teachers about that processing, and handle their requests. We support you in doing so as described in the Data Processing Agreement.

Accounts and access management.

• - You appoint administrators and assign their rights yourself. The Platform's permission model is granular; it is your responsibility not to grant more rights than necessary.
• - You ensure that accounts of departing staff, teachers or board members are revoked in good time.
• - Credentials are personal and may not be shared. Shared or group accounts make it impossible to attribute actions to a person, which is precisely what the Platform's logging is intended to achieve.
• - You notify us without delay if you suspect an account has been compromised.
• - You are responsible for all use taking place through your organisation's accounts.

Permitted use.

You use the Platform solely for lawful purposes and in accordance with the documentation. You ensure your End Users do the same.

Prohibited use.

It is not permitted to:

• - post or distribute unlawful, discriminatory, threatening, hateful or otherwise illegal content;
• - infringe the rights of third parties, including copyright, trademark rights and portrait rights;
• - probe, load or circumvent the Platform or the underlying infrastructure in a manner not covered by the reporting arrangement in article 11;
• - circumvent security measures, or attempt to gain access to another organisation's data;
• - send unsolicited commercial messages (spam), or use the email channel for anything other than communication with your own constituency;
• - deploy automated processes that place a disproportionate load on the Platform;
• - make the Platform available to third parties outside your own organisation, or use it to offer a competing service.

Fair use.

The Services are provided on a fair use basis. If your use structurally places a disproportionate load on the Platform compared with similar organisations — for example through very large volumes of storage, email or automated requests — we will consult with you before taking any measure. We only take a measure if that consultation does not lead to a solution within a reasonable period, unless the load acutely threatens the stability or security of the Platform.

Sending email.

If you send email via the Platform, you are the sender. You ensure that you are permitted to approach the recipients, and that commercial messages contain an unsubscribe option (article 11.7 of the Dutch Telecommunications Act). If you send via your own mailbox, the limits of your own email provider apply; the Platform respects those limits and sends in a staggered manner.

Your own facilities.

You provide up-to-date, supported equipment and software on your side, and are responsible for securing it. A large proportion of security incidents at comparable organisations begins with a compromised device or a reused password on the customer's side, not with the platform.

Indemnity.

You indemnify us against third-party claims relating to the Customer Data, to the use of the Platform by your organisation or its End Users, or to a breach of this article. This indemnity does not apply insofar as the claim results from a failure attributable to us.

Our rights.

All intellectual property rights in the Platform — the software, the design, the database structure, the documentation and the materials arising from it — vest in Aqlemy or its licensors. Nothing in these Terms constitutes a transfer of those rights.

Your right of use.

For the term of the agreement we grant you a non-exclusive, non-transferable, non-pledgeable and non-sublicensable right to use the Platform for your own organisation, within the chosen Package. That right ends by operation of law at the end of the agreement.

Trade name and figurative mark.

Aqlemy is the trade name under which Haakje B.V. supplies. The name, figurative mark and house style of Aqlemy may not be used without our prior written consent, other than to state that your organisation uses the Platform.

Your content remains yours.

Customer Data remains the property of your organisation. You grant us only the right of use necessary to deliver the Services: storing, processing, displaying, transmitting to the connections you have enabled, and backing up. That right is limited to that purpose and ends at the end of the agreement, subject to the retention periods in article 16.

We do not train models on your data.

The Platform's AI functions run on a language model on our own hardware. Your Customer Data is not used to train, fine-tune or evaluate models, and is not shared with any external language-model provider.

Statistics.

We may use aggregated usage statistics that cannot be traced back to a person or organisation in order to improve the Platform and plan capacity.

Suggestions.

If you make a suggestion for improvement, we may use it freely without owing any fee or attribution.

Third-party and open source components.

The Platform contains third-party components, including open source components. The licence terms of the respective rightsholders apply to those components. Insofar as those terms differ from this article, they prevail for those components.

Reporting unlawful content.

If you believe content on the Platform infringes your rights or is otherwise unlawful, report it with reasons to legal@aqlemy.com, stating the location and the ground of your objection. We assess the report and pass it to the Organisation concerned, which as the publisher of the content is responsible for it. In the case of manifestly unlawful content we may render it inaccessible ourselves. We apply Dutch law and the Digital Services Act in doing so; the United States Digital Millennium Copyright Act does not apply to us.

Two roles, and it matters which one applies.

For the personal data of your members, students, parents and teachers, you are the controller and we are the processor. You determine the purposes for which that data is processed; we process it solely on your instructions.

For the data of our own customer relationship — your contact person, the invoicing, the visitors to our own website, and our own security and system logging — we are the controller. Those processing activities are described in our Privacy Policy.

The Data Processing Agreement.

The Data Processing Agreement referred to in article 28(3) GDPR forms an integral part of this agreement and applies as soon as you register. The full text is at aqlemy.com/en/processing-agreement and is made available in four languages, with a version number and effective date. It covers, among other things: the right of instruction, confidentiality, the security measures, the obligation to report personal data breaches, assistance with data subject requests and with a data protection impact assessment, sub-processors, transfers outside the EEA, the audit right, and the return and deletion of data.

Sub-processors.

We engage sub-processors. The current register — stating per party the purpose, the categories of data, the country and the transfer basis — is at aqlemy.com/en/subprocessors. Changes are notified in advance and you may object; the arrangement is set out in the Data Processing Agreement.

Your own obligations.

You inform your data subjects, apply a valid legal basis, and do not provide us with personal data you are not permitted to provide. You process special categories of personal data (article 9 GDPR) only if you have a valid exemption ground; the Platform provides no special facility for this and is not designed for it.

Security.

The technical and organisational measures are set out in article 11 and, more extensively and verifiably, in the security annex to the Data Processing Agreement.

Children.

Consent of children under 16 for information society services requires the consent or authorisation of a parent or guardian (article 8 GDPR, article 5 of the Dutch GDPR Implementation Act). The Platform enforces that threshold and, where the date of birth is unknown, assumes the safest scenario. As controller, you are responsible for ensuring that such consent exists.

What we commit to.

We make every effort to keep the Platform available 24 hours a day, 7 days a week. We do not give an availability guarantee expressed as a percentage. That is a deliberate choice: we do not measure availability with an independent, external measurement and would therefore be unable to substantiate a percentage in a dispute. A standard that neither the supplier nor the customer can verify is not a standard.

We do not warrant that the Platform is error-free or uninterrupted.

We make every effort to remedy reported errors within a reasonable period, and are entitled to apply temporary solutions or problem-avoiding limitations in doing so.

Scheduled maintenance.

• - We announce scheduled maintenance at least 48 hours in advance in the administration portal and, where an interruption of more than 30 minutes is expected, by email to the administrators.
• - We schedule maintenance as far as possible outside the hours during which the Platform is most intensively used.
• - Scheduled maintenance does not count as an Outage.

Emergency maintenance.

Maintenance necessary to close a security vulnerability, stop abuse or restore the stability of the Platform is carried out without prior announcement. We inform you about it as soon as possible afterwards.

Where the Platform runs.

The Platform and the associated database run on a server at OVHcloud, in a data centre within the European Union. The database runs on that same server and not with an external database provider. There is deliberately no hosting with a United States provider.

Backup, data loss and recovery.

• - A backup of the database and the uploaded files is made daily. The backup is encrypted before transmission and stored with the same hosting provider in a region other than that of the production server.
• - The retention of the backups is 7 daily, 4 weekly and 12 monthly snapshots. In addition, the hosting provider makes a daily system image with a retention of 7 days.
• - Maximum data loss in the event of a disaster is therefore 24 hours (the time between two backups).
• - Our target recovery time after a total loss of the server is 1 to 3 hours. There is no automatically failing-over standby server; recovery is a manual rebuild.
• - Our recovery obligation in the event of corruption or loss of data is limited to restoring the most recent available backup. We are not obliged to reconstruct data missing from that backup.
• - You are responsible for periodically exporting data you also wish to have available outside the Platform. The Platform provides export functions per component.

Outside our sphere of influence.

We are not responsible for interruptions resulting from your internet connection, your equipment, your email provider, or a failure at a third party engaged by you such as your payment service provider or email service.

Support.

• - Channels: support@aqlemy.com and +31 85 212 8355, available on business days from 09:00 to 17:00 (CET).
• - We commit to a response time, not a resolution time. The response time is the period within which a human being has read and assessed your report and informs you what will happen.
• - The Platform is unusable for your organisation: response within 1 business day.
• - A function does not work as intended, but a workable alternative exists: response within 2 business days.
• - A question, a wish or a request for guidance: response within 5 business days.
• - Outside office hours email is read but not guaranteed to be handled.
• - The service is delivered by a small organisation. Response times do not run during a closure period we announce at least 14 days in advance in the administration portal; we do not schedule such a period in the weeks when the Platform is most intensively used.
• - In the event of unforeseen absence we report this as soon as possible in the administration portal and response times are suspended for its duration. An outage that renders the Platform unusable for your organisation is given priority even then.
• - These times apply equally to all Packages. There is no support level that can be purchased separately.
• - Support covers answering questions about using the Platform and investigating outages. It does not cover entering or cleaning up your data, configuring your organisation or training your staff; we may charge a fee for that after prior notification.
• - Documentation and instructional material are available in the administration portal.

Our measures.

We take appropriate technical and organisational measures as referred to in article 32 GDPR. The full, verifiable description is in the security annex to the Data Processing Agreement. In summary:

• - All traffic to the Platform runs over an encrypted connection (TLS).
• - Contact details and other sensitive fields are stored encrypted using AES-256-CBC, with a key kept outside the program code.
• - Access is separated per organisation and per role; the permission model is granular and administrators can enable two-step verification.
• - Sign-in attempts are rate-limited, and a sign-in from an unknown device or a different country produces a notification to the user with the option to end all sessions.
• - Actions in the administration portal are recorded in an activity log that you can inspect yourself.
• - Backups are encrypted before they leave the server.

Scope of the encryption.

Encryption at rest applies to the designated fields; student names, grades, absences and message content are stored as ordinary text on an encrypted disk behind a protected server. Your organisation can view the data and technically so can we — without that access the service cannot be delivered. We state this because it determines your own risk assessment and, in the event of a personal data breach, whether you must inform data subjects (GDPR article 34(3)(a)).

What our security rests on.

On the measures above and on the security annex to the Data Processing Agreement, not on an external certification. If you ask for an ISO 27001 or SOC 2 statement, the answer is that we do not hold one; the route that takes its place is the audit arrangement in article 16 of the Data Processing Agreement, under which you can have compliance verified yourself.

Reporting a vulnerability.

If you discover a vulnerability in the Platform, report it to support@aqlemy.com. We confirm receipt within 5 business days and keep you informed of the handling. We take no legal action against a reporter who:

• - went no further than necessary to demonstrate the vulnerability;
• - did not view, copy, modify or delete third-party data;
• - did not share the vulnerability with others before it was remedied;
• - did not carry out an attack on the availability of the Platform and did not apply social engineering, phishing or physical intrusion.

Personal data breaches.

The obligation to report a personal data breach is governed by the Data Processing Agreement: we inform you without undue delay and in any event within 48 hours of becoming aware, so that you remain comfortably within your own 72-hour deadline for reporting to the Dutch Data Protection Authority.

Limitation of our liability.

Our total liability for an attributable failure in the performance of the agreement, or on any other legal ground whatsoever — expressly including any failure to perform a guarantee or indemnity obligation agreed with you — is limited to compensation for damage as set out in this article.

Direct damage.

Our liability for direct damage is limited to the amount of the price stipulated for the agreement, excluding VAT. Because the agreement is a continuing agreement, that price is set at the total of the fees you owed in the twelve months preceding the damage-causing event. This cap applies per event and to all events in the same calendar year taken together; a series of connected events or a continuing failure counts as one event for this purpose. In no event will our total liability for direct damage exceed € 250,000 (two hundred and fifty thousand euros).

Injury and damage to property.

Liability for damage due to death, personal injury or material damage to property is limited to € 1,250,000 (one million two hundred and fifty thousand euros).

Excluded damage.

Our liability is excluded for indirect damage, consequential damage, lost profits, lost savings, reduced goodwill, damage due to business interruption, reputational damage, damage as a result of claims by your members or students, and damage relating to the engagement of third parties prescribed by you or connections designated by you. Also excluded is our liability relating to the corruption, destruction or loss of data or documents; in such a case our obligation extends no further than restoring the most recent available backup, as provided in article 10.

When the limitation does not apply.

The limitations and exclusions in this article lapse insofar as the damage results from intent or wilful recklessness on the part of our management.

They further do not apply, as provided in article 15 of the Data Processing Agreement, to: (a) a recourse action under article 82 GDPR; and (b) recovery of an administrative fine paid to the supervisory authority, insofar as it is wholly or partly attributable to the other party. This exception is deliberate: a contractual limitation of liability that also applied against a recourse action under the GDPR would hollow out the statutory allocation of risk between controller and processor. The sector standard for Dutch education excludes it for that reason, and we follow it.

Default required.

Unless performance by us is permanently impossible, our liability arises only after you have given us written notice of default without delay, allowing a reasonable period for remedy, and we continue to fail attributably after that period. The notice of default contains as complete and detailed a description of the failure as possible, so that we can respond adequately.

Notification and limitation period.

A condition for any right to compensation is that you notify us of the damage in writing as soon as possible after it arises. Any claim for compensation against us lapses by the mere passage of twenty-four months from the moment the claim arose, unless you have brought legal proceedings before the expiry of that period.

Your liability.

You are liable for damage resulting from unlawful or incomplete instructions, from inaccurate or unlawfully obtained Customer Data, or from a breach of article 7. The indemnity in article 7 remains in full force.

Neither party is obliged to perform any obligation, with the exception of payment obligations relating to services already delivered, if it is prevented from doing so as a result of force majeure.

Force majeure includes in any event:

• - an outage or failure at our hosting provider, payment service provider, email service or another engaged third party, insofar as it is not attributable to us;
• - a failure of electricity, internet or telecommunications;
• - a targeted attack on the availability of the Platform (DDoS), or another attack that succeeds despite appropriate measures;
• - government measures, war, terrorism, natural disasters, fire, flooding and epidemics;
• - a defect in software or hardware supplied by third parties, including a vulnerability for which no remedy is yet available;
• - strike or illness, insofar as the service can reasonably not be continued as a result.

Notification.

The party invoking force majeure informs the other party as soon as possible, with an estimate of the nature and expected duration.

Duration.

If the force majeure situation lasts longer than 90 days, either party is entitled to terminate the agreement in writing, without being obliged to pay any compensation. What has been performed by that time is settled pro rata.

Not force majeure.

A shortage of staff, a liquidity shortage, or the unavailability of a backup because the backup process was not executed or not verified, does not constitute force majeure.

Power to amend.

We may amend these Terms. Every amendment receives a new version number and an effective date, and the new text is published at aqlemy.com/en/terms-of-service.

Editorial amendment.

An amendment that does not affect your rights and obligations — a language correction, a clarification, a changed web address — takes effect on the published effective date, without further notice. Such an amendment locks nobody out of the Platform.

Substantive amendment.

Where a provision affecting your rights or obligations changes, we:

• - announce it at least 30 days before the effective date, by email to the administrators and with a notice in the administration portal;
• - state what is changing and why;
• - allow you to terminate the agreement as of the effective date of the change, free of charge;
• - ask, where the change constitutes a material change of rights or obligations, for express acceptance in the administration portal. That acceptance is recorded with the version number, checksum and timestamp.

What we do not do.

We do not treat continued use as agreement to a substantive amendment. Agreement follows from an express act, or from the absence of a termination after a notification that clearly identifies the change.

Amendment required by law.

Where an amendment results from amended legislation or from an instruction of a competent authority, we may implement it at the moment legally required. We still notify the amendment, but there is no right of termination as of the effective date.

Amendment of the Data Processing Agreement.

This article does not apply to the Data Processing Agreement; that has its own amendment arrangement.

Termination by you.

• - During the trial period: at any time, free of charge, with immediate effect. Nothing is ever collected; access ends at the end of the trial period.
• - With a running Subscription: at any time, as of the end of the current, already paid month. You retain access until the end of that period. There is no notice period longer than one month and no minimum term.
• - You can cancel via the settings in the administration portal or by email to support@aqlemy.com. We confirm the cancellation in writing.
• - Periods already paid are not refunded pro rata, subject to the goodwill arrangement in article 5.

Termination by us.

We may terminate the agreement in writing observing a notice period of three months. If we terminate, we grant you undiminished access until the end of that period and cooperate with the export of your data in accordance with article 16.

Rescission.

Either party may rescind the agreement on account of an attributable failure to perform a material obligation, but only after the other party has been given written notice of default in as much detail as possible and a reasonable period for remedy, and continues to fail attributably after that period. Payment obligations and obligations to cooperate are in all cases considered material.

Immediate termination.

Either party may terminate the agreement in writing with immediate effect if the other party is granted a suspension of payments, is declared bankrupt, or its business is liquidated or discontinued other than for the purpose of reconstruction or merger.

Suspension.

We may suspend access to the Platform in whole or in part if:

• - a payment fails to arrive, observing the grace period and warning in article 5;
• - the use poses an acute danger to the security, integrity or availability of the Platform or of other organisations;
• - there is a reasonable suspicion of use contrary to article 7, and the interest of immediate intervention outweighs the interest of continued use.

Upon suspension we inform you without delay, stating the reasons and what must happen for access to be restored. Suspension leaves your payment obligation intact and is never a deletion of data: your Customer Data remains unchanged.

Consequences of termination.

At the end of the agreement your right to use the Platform ends. What happens to your data thereafter is set out in article 16. Provisions which by their nature are intended to continue after the end of the agreement — including those on intellectual property, liability, confidentiality, return of data and applicable law — remain in force.

This article governs what happens to your data when the agreement ends. It supplements article 14 of the Data Processing Agreement; in the event of conflict, the Data Processing Agreement prevails.

During the term.

You can export data from the administration portal yourself at any time. Available exports include: member records, students and parents, cash book and financial overviews, exam results, inventory and self-composed reports — in CSV, XLSX or PDF. Individual End Users can request their own file as JSON via the mobile application.

At the end of the agreement.

• - Your access to the administration portal continues for 30 days after the end date in read-only form, so that you can make exports you had not made earlier. Exception: if the agreement was terminated for abuse as referred to in article 15, we provide the export on request outside the portal.
• - At your written request we provide, within 30 days, a complete export of your Customer Data in a structured, commonly used and machine-readable format. No costs are attached to a first export. For a repeated request or a request in a different format we may charge a reasonable fee after prior notification.
• - On request we provide a description of the structure of the exported data, so that you can import it elsewhere.

Deletion.

• - Unless you request otherwise in writing, we delete your Customer Data from the production environment within 90 days of the end of the agreement.
• - Data in backups disappears with the backup cycle. Because we retain 12 monthly snapshots, it may take up to 12 months before the last copy has expired. A backup is not selectively edited: that would compromise the integrity of the backup and make recovery unreliable. During that period the data remains encrypted and is used solely for recovery.
• - We confirm the deletion in writing.

What is retained, and why.

• - Financial and tax records — payments, invoices, cash book entries, expense claims and donations — are retained for approximately 7 years under the tax retention obligation (article 52 of the Dutch General Tax Act). Names, email addresses, addresses and account numbers are removed from them; the amounts, dates and entries remain.
• - The evidence that your organisation accepted these Terms and the Data Processing Agreement is retained, with version number, checksum and timestamp. The IP address and browser information of that action are erased. Legal basis: article 17(3)(e) GDPR, the establishment or defence of legal claims.
• - Immutable registers — the archive overview, the audit log of platform actions and the deduplication record of payment notifications — remain untouched. They contain no substantive personal data of your members or students.

Transfer to another supplier.

We provide reasonable cooperation with a transition to another supplier, including answering questions about the structure of the export. For work going beyond providing the export we may charge a fee after prior notification. We never withhold data as leverage: even in a payment dispute you receive your export.

Applicable law.

These Terms and all agreements to which they apply are governed exclusively by Dutch law. The United Nations Convention on Contracts for the International Sale of Goods (CISG) is excluded.

Consultation first.

The parties will endeavour to resolve a dispute by mutual consultation first. A party notifies the other party of the dispute in writing, describing what it requires. If that does not lead to a solution within 30 days, recourse to the courts is open. This provision does not prevent either party from seeking interim relief where urgency requires it.

Competent court.

Disputes are submitted to the Amsterdam District Court. If the matter is one that under article 93 of the Dutch Code of Civil Procedure is heard by the subdistrict court, the subdistrict division of that court has jurisdiction.

No consumer arrangement.

The agreement is concluded with an organisation and not with a consumer. Consumer legislation, the consumer ombudsman and the European ODR platform therefore do not apply.

Your relationship with your own constituency stands apart.

A dispute between your organisation and its members, students, parents or teachers falls outside this agreement and has its own rules. We are not a party to it.

Complaints about data processing.

A data subject who believes their personal data is being processed incorrectly may address your organisation as controller, and additionally has the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Entire agreement.

These Terms, together with the documents listed in article 1, constitute the entire agreement between the parties and replace all earlier oral and written arrangements on the same subject.

Partial invalidity.

If a provision is void, voidable or otherwise unenforceable, the remaining provisions remain in full force. The parties will in that case consult to replace the provision concerned with an enforceable provision that approximates its purpose and intent as closely as possible.

No waiver.

Failure to exercise a right under these Terms, or not exercising it immediately, does not constitute a waiver of that right.

Assignment.

You may not assign your rights and obligations under the agreement without our prior written consent, which will not be withheld on unreasonable grounds. If your organisation merges into another legal entity, we grant that consent save for compelling objections.

We may assign our rights and obligations in the context of a merger, acquisition or transfer of the business, provided the level of protection for your data remains the same and the Data Processing Agreement continues to apply in full. We announce this at least 30 days in advance; if you do not agree, you may terminate the agreement as of the date of transfer.

Confidentiality.

The parties keep confidential information received from each other secret, and use it solely for the performance of the agreement. This obligation does not apply to information that is already public, was lawfully obtained from a third party, or must be provided pursuant to a statutory obligation or a court order. The obligation survives the end of the agreement.

Notices.

Notices are given in writing. A notice to the email address known to us of your organisation's administrator constitutes a valid notice to your organisation. You report a change of that address without delay in the administration portal. Our contact details are in article 19.

Reference.

We may name your organisation and use its logo as a reference on our website and in our materials. If you object, let us know and we will not.

Language.

The Terms are available in Dutch, Turkish, English and Arabic. In the event of a difference in interpretation, the Dutch text prevails.

Survival.

The articles on intellectual property, liability, confidentiality, return and deletion of data, and disputes and applicable law remain in force after the end of the agreement.

For questions about these Terms of Service:

Company details

Company: Haakje B.V. Trade name: Aqlemy Chamber of Commerce number: 42160038 VAT identification number: NL869977817B01 Place of business: Haarlem, the Netherlands

Contact

Legal matters: legal@aqlemy.com Privacy and data subject requests: privacy@aqlemy.com Technical support: support@aqlemy.com General enquiries: ask@aqlemy.com Telephone: +31 85 212 8355

Availability

Monday to Friday, 09:00 - 17:00 (CET). Outside those hours email is read but not guaranteed to be handled.

Legal notices

Service of process and formal notices of default should be addressed to the company above. For urgent legal matters: legal@aqlemy.com.

Supervisory authority

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), PO Box 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl.